OIDC Discovery Endpoint Vulnerability in Dapr Sentry by Dapr

CVE-2026-59096

What is CVE-2026-59096?

The Dapr Sentry's OIDC discovery endpoint contains a vulnerability where the issuer and jwks_uri are derived from the request Host, allowing an attacker to exploit this through an unvalidated X-Forwarded-Host header when no allowed-hosts list is set. This could enable a remote, unauthenticated attacker to manipulate the discovery document, leading to reliance on a malicious JWKS hosted on an attacker-controlled server. Consequently, this could result in the acceptance of attacker-signed JWTs, undermining authentication processes for any relying parties.

References